Apache
/
hadoop
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

HADOOP-14001. Improve delegation token validity checking. 

(cherry picked from commit 1763467210)
(cherry picked from commit c6c29d0080)
This commit is contained in:
Akira Ajisaka 2017-01-19 17:56:39 +09:00
parent e7b4f88acd
commit b8b8b9a32b
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java
View File

@ -21,7 +21,7 @@ package org.apache.hadoop.security.token.delegation;
import java.io.ByteArrayInputStream; import java.io.ByteArrayInputStream;
import java.io.DataInputStream; import java.io.DataInputStream;
import java.io.IOException; import java.io.IOException;
import java.util.Arrays; import java.security.MessageDigest;
import java.util.HashMap; import java.util.HashMap;
import java.util.HashSet; import java.util.HashSet;
import java.util.Iterator; import java.util.Iterator;
@ -467,7 +467,7 @@ extends AbstractDelegationTokenIdentifier>
public synchronized void verifyToken(TokenIdent identifier, byte[] password) public synchronized void verifyToken(TokenIdent identifier, byte[] password)
throws InvalidToken { throws InvalidToken {
byte[] storedPassword = retrievePassword(identifier); byte[] storedPassword = retrievePassword(identifier);
if (!Arrays.equals(password, storedPassword)) { if (!MessageDigest.isEqual(password, storedPassword)) {
throw new InvalidToken("token " + formatTokenId(identifier) throw new InvalidToken("token " + formatTokenId(identifier)
+ " is invalid, password doesn't match"); + " is invalid, password doesn't match");
} }
@ -516,7 +516,7 @@ extends AbstractDelegationTokenIdentifier>
+ id.getSequenceNumber()); + id.getSequenceNumber());
} }
byte[] password = createPassword(token.getIdentifier(), key.getKey()); byte[] password = createPassword(token.getIdentifier(), key.getKey());
if (!Arrays.equals(password, token.getPassword())) { if (!MessageDigest.isEqual(password, token.getPassword())) {
throw new AccessControlException(renewer throw new AccessControlException(renewer
+ " is trying to renew a token " + " is trying to renew a token "
+ formatTokenId(id) + " with wrong password"); + formatTokenId(id) + " with wrong password");